Backstage: Improper entity validation in deprecated Kubernetes services endpoint

### Impact An authenticated user with Kubernetes read permissions could access Kubernetes workload data beyond their intended scope by supplying crafted entity data to the deprecated services endpoint. The exposure is limited to read-only access to Kubernetes object metadata across configured clusters. ### Patches Patched in `@backstage/plugin-kubernetes-backend` version 0.21.8. ### Workarounds - Disable the deprecated `/services/:serviceId` route by deploying a custom Kubernetes router that omits it. - Restrict access to the `kubernetes.resources.read` permission to limit the set of users who can reach the endpoint.

Source published

7 Oct 2026 18:02:37 UTC

Source modified

7 Oct 2026 18:15:11 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Publisher rating · MODERATE